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To tind more about the NHS COVID-19 app or to view the Data 
Protection Impact Assessment (DPIA) visit www.covid19.nhs.uk 


The NHS COVID-19 app has been built 
on a principle of ‘Privacy by Design’ 
meaning your privacy and data security 
is at the heart of the app. 


Find out more about how the app 
protects your data and privacy. 








What data does the app store collect? 


The app collects the following information and holds it on your phone: 


e The postcode district you enter when you install the app, this is the first part of 
your postcode before the space 

e The symptom information you enter onto the app 

e The QR poster codes of the venues that you scan into the app 


You are able to view all the data held about you and you can delete it at any time. 


How can | be sure my data is safe? 


The app has been designed using Google and Apple technology to use as little 
personal data and information as possible. All the data that could directly identify 
you Is held on your phone and not shared anywhere else. Any data that is provided 
from the phone will always be made anonymous to prevent us and anyone else from 
identifying you or others. 


The app uses random unique IDs Tor contact tracing. These codes are shared 
between other app users’ phones and they change every 15 minutes. When shared, 
these codes will remain on phones for 14 days to cover the incubation period of 
coronavirus. There is no way for another app user to identify you trom this code. 








What data is shared outside the app? 


By using the app, analytics data is collected which helps us to learn more about the 
virus and how we can develop our public health response. For example, we can tell 
the number of people who have booked tests, through data collected, when you 
select the option to ‘book a test’ on the app. By entering symptoms and sharing 
this information with the app, we can learn more about the locations where 
symptoms are developing. 


All analytics data Is anonymous and cannot be linked back to you In any way. By 
using the app, you will be making an important contribution in supporting the NHS 
and helping us to win the fight against coronavirus. 


Why does the NHS COVID-19 app ask for my postcode district? 


The app only uses your postcode district. This is the first part of your postcode up 
until the space. For example, “PE12”. It will not provide the precise location where 
you live. 


We need your postcode district to help the NHS: 


e Learn more about the impact of coronavirus (COVID-19) on the public, 
communities and local services 

e Monitor the effectiveness of the app 

e Predict and manage demand on local hospital services 

e Provide tailored advice to people and app users living within an area at high risk 
of coronavirus 








What data is stored with venue check-in? 


If you choose to use the venue check-in feature, your phone will only store data 
about when and where you checked In and what time. This will help to remind you 
about where you have been, If you are contacted by an NHS contact tracer. The data 
is stored for 21 days and you can review or delete this data at any time. This means 
you can delete all venues or any specitic venue of your choice. 


Can | be identified if | share my data? 


The NHS COVID-19 app does not hold any information which could directly identity 
you, tor example your name, address or date of birth and Is fully compliant with 
Data Protection Law. 


If you test positive for coronavirus and decide to share this information with the app 
so others can be alerted, random unique IDs are used as part of the contact tracing 
technology. No personal data is shared between your phone and anyone else’s 
phone. 


Whilst you cannot be identified by data you share or data held on your phone, in 
some unlikely circumstances, others may be able to work out that you were the 
person who tested positive Tor the virus, when they receive an alert. For example, If 
an app user had only been in contact with you and no one else in the 14 days 
before receiving the alert. However, this could also happen with contact tracing 
done by public health services, even if you are not using the app. The app Itselt 
cannot share or send any personal information about you, when sending alerts. 


Why does the NHS COVID-19 app need permission to access my 
camera? 


The app uses your camera to read the NHS QR code, which is found on posters at 
the venues you visit. Once you have checked in, the time, date and venue is stored 
on your phone. The camera access Is then immediately disabled. The app cannot 
access any photos on your phone. 


Can | delete the app? 


You can delete the app at any time. This will also delete all data stored on the app. 
If you choose to delete the app, you will no longer receive exposure alerts and 
notifications. 


These alerts let you know if you are at risk of infection of coronavirus. The app 
works in addition to the regular contact tracing that is already taking place 
throughout England and Wales. 


If you no longer want to use the app, contact tracers will be in touch if you have 
been exposed to someone who has the virus. However, the app Is the fastest way to 
see if you are at risk and the quicker you know, the quicker you can alert and 
protect your loved ones. The app also does the ‘remembering’ tor you, using contact 
tracing technology, the app remembers other app users that you have spent time 
near for 15 minutes or more at a distance of 2 metres or less, so you don’t have to. 


How long will my contact tracing data be stored? 


The NHS COVID-19 app will keep a log of anonymous contact tracing data for a 
maximum of 14 days (that is, the maximum length of time that infection with the 
virus Is likely to incubate). 


Venue check-in information is stored tor 21 days. This takes into account not only 
the Tull 14-day incubation period of the virus, but also an additional 7 days. This will 
allow time tor Health Protection teams to Tinish any investigation of an outbreak. 


The app automatically deletes contact tracing data and venue check in data after 


these periods have expired. 


To tind more about the NHS COVID-19 app or to view the Data Protection Impact 
Assessment (DPIA) visit www.covid19.nhs.uk 
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